CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

• CWE-522
• CWE-522

• http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdfBroken Link
• https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releaseRelease Notes
• https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15Release Notes
• https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlBroken Link, Third Party Advisory
• https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/Exploit, Third Party Advisory
• https://www.zyxel.com/support/CVE-2020-29583.shtmlVendor Advisory
• https://www.zyxel.com/support/security_advisories.shtmlVendor Advisory
• http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdfBroken Link
• https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-releaseRelease Notes
• https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15Release Notes
• https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.htmlBroken Link, Third Party Advisory
• https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/Exploit, Third Party Advisory
• https://www.zyxel.com/support/CVE-2020-29583.shtmlVendor Advisory
• https://www.zyxel.com/support/security_advisories.shtmlVendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29583US Government Resource

Published

Dec 22, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-29578The official piwik Docker images before fpm-alpine (Alpine s…9.8
• CVE-2020-29579The official Express Gateway Docker images before 1.14.0 con…9.8
• CVE-2020-2958Vulnerability in the Oracle VM VirtualBox product of Oracle …7.5
• CVE-2020-29580The official storm Docker images before 1.2.1 contain a blan…9.8
• CVE-2020-29581The official spiped docker images before 1.5-alpine contain …9.8
• CVE-2020-29582In JetBrains Kotlin before 1.4.21, a vulnerable Java API was…5.3
• CVE-2020-29587SimplCommerce 1.0.0-rc uses the Bootbox.js library, which al…5.4
• CVE-2020-29589Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-2959Vulnerability in the Oracle VM VirtualBox product of Oracle …8.6
• CVE-2020-29590Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-29591Versions of the Official registry Docker images through 2.7.…9.8
• CVE-2020-29592An issue was discovered in Orchard before 1.10. A broken acc…9.8